I have a file server where all my folders and files are located. those file are distributed according to department. Security and permissions are done as per department. SO for each folder I have three types of users, FUll Control, write no modify, and read only.
I am afraid that those users can copy files or send it by e-mail to any competotor or someone outside the company.
Does anyone have a solution on how to prevent this and have more control
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
I don't think this can be done using windows rights because if you have given read access to user this enable user to copy that file and there is no option available in windows to stop this, maybe this can be done using third party application but not sure.
A solution for this type of users (which is not very good) is allow them access these file through terminal service instead of folder sharing.
There are some ways to control what you're talking about, but I don't see it done very often. Mostly in larger companies with legal regulations or implications related to data loss. A compliance specialist would be able to help with this a bit more.
Having worked in a hospital environment, I've had to work with some of these solutions. Vericept is one product we used: https://www.vericept.com/i
There are numerous solutions to the USB issue, from disabling front-panel ports to software solutions. Here's one group of people who have taken on the task:
http://diaryproducts.net/a
The Kbox from Kace provides all kinds of management and IT admin tools. In the following document they also list the ability to block USB fobs: http://www.kace.com/pdf/wh
All in all, this is a tough problem to solve with technology; possible but expensive in $$ and time and not 100% effective. Combining policy/procedures and some technology measures is likely the best solution. If this is critical to your business due to regulations or management decisions, then you may want to see about hiring a compliance consultant or an in-house security officer to help select protection systems, but then also to review the large amounts of data generated by these solutions to identify issues and research as needed.
I pretty much agree with the other experts: the challenge you pose it's very expensive to overcome, and money is probably better spent elsewhere. However, according to the type of data you are trying to save there could be different solutions: for instance Microsoft Office offers Digital Right Management products which could be what you need. Whatever you implement, keep in mind that you have to cover ALL ways out: no sense in spending money and leave just one small trapdoor to the outside.
I'll add a vendor here, Verdasys (http://www.verdasys.com/)
Oooh...good call on the DRM. Adobe also allows you to put restrictions on PDF documents like no copy/paste and no printing. DRM is a way of embedding the "allowable uses" within the file themselves. This frequently relies on the author of the document to configure the DRM rules, however, and this means you are trusting your users.
One other thought I had was it depends on what you're trying to prevent. Some techniques will put up a barrier, although not an impenetrable one. This would likely help keep honest people honest. It would be quite hard to prevent a user from taking and sharing data if they really wanted to do so and also had technical ability. There are all sorts of ways to bypass controls you may have put in place like screen shots/captures, "printing" to PDF or MDI, and using a web-based email like Gmail to email out documents bypassing your corporate mail server's policies.
Make sure people only have access to information they need to complete their job and make sure they would not have a desire to pass information to a competitor. Lastly, when someone leaves your company, make sure their account is disabled immediately.
Business Accounts
Answer for Membership
by: samenglishPosted on 2009-07-20 at 22:18:32ID: 24901427
If a user has read access then they can print it, copy it to a USB stick, or attach it to an email. You can monitor the print queue, frisk your employees, and monitor outgoing emails... or you can make sure your employees feel that they are part of the company by paying them well and giving them further incentives to feel like the company they work for is actually taking care of them... apart from that, there are always laws and confidentiality agreements that you could consider employing.